Linux/Unix lsof command

[root@redhat ~]# lsof --help

lsof: illegal option character: -

lsof: -e not followed by a file system path: "lp"

lsof 4.78

 latest revision: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/

 latest FAQ: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ

 latest man page: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/lsof_man

 usage: [-?abhlnNoOPRstUvVX] [+|-c c] [+|-d s] [+D D] [+|-f[gG]] [+|-e s]

 [-F [f]] [-g [s]] [-i [i]] [+|-L [l]] [+m [m]] [+|-M] [-o [o]]

 [-p s] [+|-r [t]] [-S [t]] [-T [t]] [-u s] [+|-w] [-x [fl]] [-Z [Z]] [--] [names]

Defaults in parentheses; comma-separated set (s) items; dash-separated ranges.

  -?|-h list help          -a AND selections (OR)     -b avoid kernel blocks

  -c c  cmd c, /c/[bix]    +c w  COMMAND width (9)

  +d s  dir s files        -d s  select by FD set     +D D  dir D tree *SLOW?*

                           +|-e s  exempt s *RISKY*   -i select IPv[46] files

  -l list UID numbers      -n no host names           -N select NFS files

  -o list file offset      -O avoid overhead *RISKY*  -P no port names

  -R list paRent PID       -s list file size          -t terse listing

  -T disable TCP/TPI info  -U select Unix socket      -v list version info

  -V verbose search        +|-w  Warnings (+)         -X skip TCP&UDP files

  -Z Z  context [Z]

  -- end option scan

  +f|-f  +filesystem or -file names     +|-f[gG] flaGs

  -F [f] select fields; -F? for help

  +|-L [l] list (+) suppress (-) link counts < l (0 = all; default = 0)

                                        +m [m] use|create mount supplement

  +|-M   portMap registration (-)       -o o   o 0t offset digits (8)

  -p s   exclude(^)|select PIDs         -S [t] t second stat timeout (15)

  -T qs TCP/TPI Q,St (s) info

  -g [s] exclude(^)|select and print process group IDs

  -i i   select by IPv[46] address: [46][proto][@host|addr][:svc_list|port_list]

  +|-r [t] repeat every t seconds (15); + until no files, - forever

  -u s   exclude(^)|select login|UID set s

  -x [fl] cross over +d|+D File systems or symbolic Links

  names  select named files or files on named file systems

Anyone can list all files; /dev warnings disabled; kernel ID check disabled.

EXAMPLES

       For a more extensive set of examples, documented more fully, see the 00QUICKSTART file of the lsof distribution.

       To list all open files, use:

              lsof

       To list all open Internet, x.25 (HP-UX), and UNIX domain files, use:

              lsof -i -U

       To list all open IPv4 network files in use by the process whose PID is 1234, use:

              lsof -i 4 -a -p 1234

       Presuming the UNIX dialect supports IPv6, to list only open IPv6 network files, use:

              lsof -i 6

       To list all files using any protocol on ports 513, 514, or 515 of host wonderland.cc.purdue.edu, use:

              lsof -i @wonderland.cc.purdue.edu:513-515

       To list all files using any protocol on any port of mace.cc.purdue.edu (cc.purdue.edu is the default domain), use:

              lsof -i @mace

       To list all open files for login name ‘‘abe’’, or user ID 1234, or process 456, or process 123, or process 789, use:

              lsof -p 456,123,789 -u 1234,abe

       To list all open files on device /dev/hd4, use:

              lsof /dev/hd4

       To find the process that has /u/abe/foo open, use:

              lsof /u/abe/foo

      To send a SIGHUP to the processes that have /u/abe/bar open, use:

              kill -HUP ‘lsof -t /u/abe/bar‘

       To find any open file, including an open UNIX domain socket file, with the name /dev/log, use:

              lsof /dev/log

       To  find  processes  with  open files on the NFS file system named /nfs/mount/point whose server is inaccessible, and presuming your mount table supplies the device

       number for /nfs/mount/point, use:

              lsof -b /nfs/mount/point

       To do the preceding search with warning messages suppressed, use:

              lsof -bw /nfs/mount/point

       To ignore the device cache file, use:

              lsof -Di

       To obtain PID and command name field output for each process, file descriptor, file device number, and file inode number for each file of each process, use:

              lsof -FpcfDi

       To list the files at descriptors 1 and 3 of every process running the lsof command for login ID ‘‘abe’’ every 10 seconds, use:

              lsof -c lsof -a -d 1 -d 3 -u abe -r10

       To list the current working directory of processes running a command that is exactly four characters long and has an ’o’ or ’O’ in character three, use this regular

       expression form of the -c c option:

              lsof -c /^..o.$/i -a -d cwd

       To find an IP version 4 socket file by its associated numeric dot-form address, use:

              lsof [email protected]

       To find an IP version 6 socket file (when the UNIX dialect supports IPv6) by its associated numeric colon-form address, use:

              lsof -i@[0:1:2:3:4:5:6:7]

       To  find  an  IP  version 6 socket file (when the UNIX dialect supports IPv6) by an associated numeric colon-form address that has a run of zeroes in it - e.g., the

       loop-back address - use:

              lsof -i@[::1]

[root@redhat ~]# lsof -r 2 +D /usr/bin/

COMMAND     PID USER  FD   TYPE DEVICE SIZE/OFF  NODE NAME

xfs        2331  xfs txt    REG  253,0   136200 75397 /usr/bin/xfs

rhsmcertd  2432 root txt    REG  253,0    10620 75238 /usr/bin/rhsmcertd

ssh-agent 21994 root txt    REG  253,0   107480 86481 /usr/bin/ssh-agent

=======